PCI Self-Assessment Questionnaire (SAQ) Validation

Tap to enlarge

Complete the Instrument fields. Each value is validated against the schema before the next step unlocks.

• Domain entity ID (required)

  entityId

  The organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.

Tap to enlarge

Complete the Validation Path fields. Each value is validated against the schema before the next step unlocks.

• Merchant / Service Provider Leveloptional

  merchantLevel

  Enter merchant / service provider level.

• Entity is a service provideroptional

  isServiceProvider

  Enter entity is a service provider.

• Payment channels in useoptional

  channels

  Enter payment channels in use.

• Account data is stored anywhere in the environmentoptional

  storesCardholderData

  Enter account data is stored anywhere in the environment.

• Payment processing fully outsourced to a validated third partyoptional

  fullyOutsourced

  Enter payment processing fully outsourced to a validated third party.

• E-commerce redirects or iframes to a validated provideroptional

  usesHostedPaymentPage

  Enter e-commerce redirects or iframes to a validated provider.

• Card-present only, standalone terminals, no electronic storageoptional

  standaloneTerminalOnly

  Enter card-present only, standalone terminals, no electronic storage.

• Terminals are IP-connectedoptional

  terminalsIpConnected

  Enter terminals are ip-connected.

• Declared SAQ typeoptional

  declaredSaqType

  Enter declared saq type.

Tap to enlarge

Complete the Control Verdicts fields. Each value is validated against the schema before the next step unlocks.

• Control assessments › Control (required)

  controlAssessments.controlId

  Enter control.

• Control assessments › Elected approachoptional

  controlAssessments.approach

  V4.0 — a defined approach follows the requirement as stated; a customized approach meets its objective another way and carries a mandatory targeted risk analysis.

• Control assessments › Verdictoptional

  controlAssessments.finding

  Enter verdict.

• Control assessments › Not-applicable justificationoptional

  controlAssessments.naJustification

  Enter not-applicable justification.

• Control assessments › Gap severityoptional

  controlAssessments.gapSeverity

  Enter gap severity.

• Control assessments › What is missingoptional

  controlAssessments.gapNote

  Enter what is missing.

• Control assessments › Compensating control worksheet referenceoptional

  controlAssessments.ccwRef

  Enter compensating control worksheet reference.

• Control assessments › Targeted Risk Analysis referenceoptional

  controlAssessments.riskAnalysisRef

  Enter targeted risk analysis reference.

• Control assessmentsoptional

  controlAssessments

  Enter control assessments.

• Control assessments › Evidence referencesoptional

  controlAssessments.evidenceRefs

  Enter evidence references.

• Total Controls Evaluatedoptional

  totalControlsEvaluated

  Enter total controls evaluated.

• Controls In Placeoptional

  controlsInPlace

  Enter controls in place.

• In Place with Compensating Controloptional

  controlsInPlaceWithCcw

  Enter in place with compensating control.

• Control assessments › Assessor override justificationoptional

  controlAssessments.overrideReason

  Required when certifying a control as in-place despite an automated engine non-compliance verdict.

• Controls Not Applicableoptional

  controlsNotApplicable

  Enter controls not applicable.

• Controls Not In Placeoptional

  controlsNotInPlace

  Enter controls not in place.

• Controls Not Testedoptional

  controlsNotTested

  Enter controls not tested.

• Control assessments › Remediation owneroptional

  controlAssessments.remediationOwner

  Enter remediation owner.

• Control assessments › Action planoptional

  controlAssessments.remediationPlan

  What will change, and how the change will be shown to have worked.

• Control assessments › Target completion date (ISO date)optional

  controlAssessments.remediationTargetDate

  Enter target completion date (iso date).

• Control assessments › Statusoptional

  controlAssessments.remediationStatus

  Enter status.

• Control assessments › Fix re-tested and verified effectiveoptional

  controlAssessments.remediationRetested

  Enter fix re-tested and verified effective.

• Control assessments › Re-test evidence referenceoptional

  controlAssessments.remediationEvidenceRef

  Enter re-test evidence reference.